Ollama versions from 0.14.0 up to but not including 0.31.2 have an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism. This flaw allows attackers who can influence model output via prompt injection to append shell control operators to approved commands, enabling execution of additional shell commands without session approval. The vulnerability has a high severity with a CVSS score of 7.8.